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When Lundbeck processes personal data collected through other channels than via Lundbeck.com, H. Lundbeck A/S will specifically inform you how your personal data is 
processed. However, for certain specific processing activities where personal data is collected or obtained via other channels/devices/third parties than Lundbeck.com, you can 


read more below. 




















Lundbeck’s property in Valby and/or 
Lumsås. 








If criminal data is 
processed the legal 
basis is § 8 of the 





GDPR. 





Type of Categories of personal data and Purpose of Legal basis Disclosure of personal Retention 
processing source if relevant processing data, if relevant and legal 
and basis for the disclosure 
categories of 
individuals 
Employee e Name and contact information e Being able to contact | The legal basis is Personal data related to 
emergency an employee’s next Lundbeck’s legitimate next of kin will be deleted 
contact - Next The source of data regarding you as of kin in case of an interest in being able once the relevant Lundbeck 
of kin to next of kin to a Lundbeck employee is emergency. to contact the next of employee no longer works 
employees at the employee. kin in case of an at Lundbeck. 
H. Lundbeck emergency, cf. Article 
A/S 6(1)(f) of the GDPR. 
Scientific e Health information e Asapharmaceutical | The legal basis is The data may be Personal data related to 
research data e Biological material / human samples company, Lundbeck | Article 9 (2)(j) of the transferred, including to scientific research will be 
- (including processes personal GDPR cf. the Danish universities or authorities, deleted according to 
RWD data) The source of data regarding scientific data for scientific Act on Processing of | subject to the provisions set | retention periods set in the 
research is various research data research purposes Personal Data out in Section 10 of the the | contracts which the source 
bases, including public databases and within a range of Section 10. Danish Act on Processing of | of the data, however, will be 
biobanks areas. Read more Personal Data. deleted at the latest 5 years 
: about Lundbeck’s after it has been received. 
activities within In specific cases, other 
The personal data will be research and appropriate legal basis may 
pseudonymised and the data will not be development here. be relied upon. 
directly identifiable to Lundbeck. 
Video e Personal data recorded by thermal e Improving the safety | The legal basis is The data obtained via video | Recordings will be deleted 
surveillance — camera on Lundbeck’s property and thereby Lundbeck’s legitimate | surveillance may be shared | after 30 days unless storage 
visitors at the increasing the level interest in trying to with the police in case of for a longer period is 
Lundbeck of security on the prevent, detect and suspicion of an illegal act. required under the Danish 
property in oe pee eee ma site in Valby and/or solve crime, cf. Article | The legal basis is § 8(4) of TV Monitoring Act. 
Valby and/or whereabouts and actions on Lumsås. 6(1)(f) of the GDPR. the Danish Data Protection 
Lumsås Act, cf. Article 10 of the 








i n a: 





Danish Data 
Protection Act, cf. 
Article 10 of the 
GDPR. 





Site access / 
Guest 
registration — 
Externals 
visiting 
Lundbeck’s 
premises in 
Valby and/or 
Lumsås 


e Name, telephone number, email 


address 


e Photo (if applicable) 


The source of data in relation to site 
access/guest registration (when not 
collected directly from you) is either a 
Lundbeck employee or your employer. 


e Being able to 
provide access to 
you as a visitor or an 
external working at 
the site for a limited 
period of time. 


The legal basis is 
Lundbeck’s legitimate 
interest in knowing 
who is always present 
on the site, cf. Article 
6(1)(f) of the GDPR. 


Personal data are stored for 
as long as necessary to fulfil 
the purpose described 
above, however, for site 
access data no longer than 
36 months, and for guest 
registration data no more 
than 12 months. 





Work related 


e Personal data that are a part of the 


e To increase safety 


The legal basis is 


We store your personal data 








accidents — information we collect on how the and to be able to Lundbeck’s legitimate for as long as necessary to 
Externals accident happened. implement corrective | interests in improving fulfil the purposes described 
working at the and preventive site security and above, however for no 
i The source of data in relation to work actions. ae A yee longer than 12 months 
related accidents may also be (when eae 
Valby and/or not collected directly from you) a 6(1)(f) of the GDPR. 
Lumsas Lundbeck employee or another witness. 
Investors — e Name, e Keeping a register of | The legal basis is Personal data are disclosed | We store your personal data 
Investors’ e Address, Lundbeck’s investors | Lundbeck’s legal to the VP SECURITIES A/S _ | for as long as necessary to 
acquisition of e Number of shares, e Inviting to general obligation the Danish | for the purpose of investor fulfil the purposes described 
shares in H. e Number of votes assembly Companies Act, cf. administration. The legal above, however for no 
Lundbeck A/S e Investor type e Analysing article 6(1)(c) of the basis is section 61 of the longer than 18 months. 
composition of GDPR, and Danish Companies Act, cf. 
investors Lundbeck’s legitimate | article 6(1)(c). 





The source of data in relation to 
investors (when not collected directly 
from you) is VP Securities A/S. 





e Being able to 
communicate with 
investors 





interests in (i) 
analysing the 
composition of 
Lundbeck’s 
shareholders, (ii) 
being able to 
communicate with 
shareholders (e.g. in 
relation to sending out 
invitation for general 
assembly) and (iii) 
paying dividends to 
shareholders, cf. 














i n a: 
| 





article 6(1)(f) of the 
GDPR. 





Meeting 
participants — 
recording of 


In limited situations, Lundbeck may 
(audio/video) record 
meeting/presentations/webinars 


e Relevant business 
purposes such as for 
example; to ensure 


The legal basis for 
recording is 
Lundbeck’s legitimate 


For smaller meetings, the 
recording may be shared 
with meeting participants or 


We store your personal data 
for a maximum of 30 days, 
unless you have been 








meetings (“Meetings”) if is assessed that there that the meeting can | interests in pursuing a | invited participants that informed otherwise. 
is a specific need and relevant be translated in case | relevant business were absent at the meeting. 
business purpose for this. The of non-English purpose (as The legal basis is 
Lundbeck meeting host will always speaking Lundbeck | described to the left), | Lundbeck’s legitimate 
specifically inform you if video employees or to cf. Article 6(1)(f) of interests in pursuing a 
recording takes place at the Meeting ensure that the video | the GDPR. In light of relevant business purpose 
you will attend. will be made the business purpose | (as described to the left), cf. 
available to invited of the meetings, the Article 6(1)(f) of the GDPR. 
In case the Meeting you participate participants if they interests of the 
in is recorded, we will process are absent at the participants are Other types of transfer or 
meeting. generally assessed uses (e.g. for larger 
e your digital image (if you have not to override meetings; upload to the 
your video camera turned on), Lundbeck's interests. | Lundbeck intranet) will be 
e audio recordings of your assessed on a case by case 
input/question at the meeting basis. 
(if you speak), and 
e written input/questions you 
provide via the chat-functions 
(e.g. for webinars or similar). 
Market Lundbeck may collect the following on e Preforming market The legal basis is If the market research study 
Research — health care professionals participating research Lundbeck’s legitimate is product related, we keep 
health care in Market Research interest in during and use the market 


professionals 
participating in 
questionnaires 
from third party 
Market 
Research 
Partners 





- Contact details and 
- Answers to market research 
questions 

The answers are collected from a third 
party market research partner, and 
compiled into a syndicated data file, 
where the personal details of the 
individuals are not included. However, 
as the relevant market research partner 
holds the key to the anonymized data 








market research in 
order to ensure the 
business of Lundbeck 
confirms with the 
market demand, cf. 
Article 6(1)(f) of the 
GDPR. 








research reports for a 
period corresponding with 
the patent protection on the 
product + and additional 5 
years. If the market 
research study is not 
product related, both more 
general within a disease 
area or a specified market, 
we keep and use the market 
research reports for no 
longer than 10 years after 
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files the data contained in the files are 
still regarded as personal data under 
the GDPR. Lundbeck will never get 
access to the key and will therefore 
never be able to link the answers listed 
in the data files to specific persons. 




















the completion of the 
market research study. 
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